CVE WatchOct 6, 2026

CVE-2026-105611

A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-syst

CVSS

2.7

Low

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 6, 2026 · Last modified: Oct 6, 2026 · CWE-266 · CWE-285

EPSS · 30d

Not enough EPSS history yet.

Technical description

A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-955948.1 HIG

—

———Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.0 versions.6h CVE-2026-481977.2 HIG

—

———Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.6h CVE-2026-397758.8 HIG

—

———Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.6h CVE-2026-397748.8 HIG

—

———Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.6h CVE-2026-3977310.0 CRI

—

———Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.6h CVE-2026-397657.2 HIG

—

———Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.6h